I have issue where W2k and XP clients connecting to Terminal Server in different domain, they connect over vpn then get "error: Terminal Server timeout" if they are not member of local administrators group on their PC (notice: we are not talking about local admins group on Terminal server) as soon as I make them local admins for their PCs everything works fine...
Is this requirments that user connecting over Terminal server needs to be a local admin on the PC ? I know you have to be loal admin if Terminal server is in Remote Administration mode, but does it have to happen if TS is running in Appliation mode

Tom P

Check the EventLog on your TS. If you see EventID 1004 (cannot
issue license) while these clients try to connect, then the
solution is to give the users write permission to the specific
registry key that stores the TS license on the client.

Users don't have to be local administrators, but they must be able
to store the license in the local registry.

HKEY_LOCAL_MACHINE\Software\Microsoft\MSLicensing

--
Vera Noest
MCSE,CCEA, Microsoft MVP - Terminal Server
http://hem.fyristorg.com/vera/IT
*----------- Please reply in newsgroup -------------*

=?Utf-8?B?VG9tIFAu?= <(E-Mail Removed)> wrote
in news:4BE71777-50DC-45BE-8637-(E-Mail Removed):

> I have issue where W2k and XP clients connecting to Terminal
> Server in different domain, they connect over vpn then get
> "error: Terminal Server timeout" if they are not member of local
> administrators group on their PC (notice: we are not talking
> about local admins group on Terminal server) as soon as I make
> them local admins for their PCs everything works fine.... Is
> this requirments that user connecting over Terminal server needs
> to be a local admin on the PC ? I know you have to be loal admin
> if Terminal server is in Remote Administration mode, but does it
> have to happen if TS is running in Appliation mode?
>
> Tom P.

Not that I'm aware of. We have the same security policy, and we solve
this by giving the local Users group access to this specific registry
key, and then we ghost all client PCs from that preconfigured image.
Won't help you to modify existing PCs, but could be good to implement
for all new PCs.

--
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
http://hem.fyristorg.com/vera/IT
--- please respond in newsgroup, NOT by private email ---

=?Utf-8?B?VG9tIFAu?= <(E-Mail Removed)> wrote
in news:EEE8BA16-C5D8-4FC9-82E7-(E-Mail Removed):

> allowing write access to registry for MSLicensess solve the
> problem, thanks. but... our domain security policy do not allow
> domain users (except admins and devs group) to be local admin
> and or power user, so I'm wondering if there's another way of
> doing it other then modifying registry on user PC ? am fine with
> this solution, just want to know if there is another way of
> doing it...
>
> Thanks again
> Tom P.

I can see a point of doing it that way.. thanks again